Hello,

A release for 1.x and 2.x would be helpful to cover SA-CORE-2023-004 and SA-CORE-2023-005.

Thank you!

CommentFileSizeAuthor
#5 not supported.png10.79 KBkruser

Comments

mlecha created an issue. See original summary.

jon pollard’s picture

jon pollard commented

... and also for the 2.x branch - which is also still missing some security updates

kruser’s picture

kruser commented

I wonder if this is still supported?

jon pollard’s picture

jon pollard commented

It's not marked as "not supported", so does that mean that it is still supported?

If it becomes 'not supported' then that becomes something of an issue for quite a few sites.

kruser’s picture

kruser commented
StatusFileSize
new not supported.png10.79 KB

It shows Not Supported on our Updates page (attached). We're just manually applying the security updates as I don't think they have any plans to keep the D7 project going.

jon pollard’s picture

jon pollard commented

The "Not Supported" on your updates page shows that the distribution contains elements which are no longer supported. I don't think that is the same thing as the distribution itself not being supported.

mlecha’s picture

mlecha commented
Title: SA-CORE-2023-004 » SA-CORE-2023-004 and -005
Issue summary: View changes
mlecha’s picture

mlecha commented

Matt Glaman provided some instuctions on what needs to be done to roll your own upgrade:
https://www.drupal.org/project/commerce_kickstart/issues/3138599#comment...

I cloned the project using:
git clone --branch 7.x-1.x https://git.drupalcode.org/project/commerce_kickstart.git
and then edited disto.make and drupal-org.make for the updates.

To produce the patch and upload the changes I think I need to commit the changes and make a diff file, but I'm not sure how to do that..

I think that witout a git account I don't have rights to commit changes? I downloaded the branch by https rather than git@

Then from the git bash shell I'm not sure what I'd need to do to download the newer core release into my files. I had assume it was something like "make" but no love there. Composer is starting to look easy! ;-)

SergFromSD’s picture

SergFromSD commented

we need new 1.0 and 2.0 branches updated with the latest drupal releases including security vulnerability fixes.

If no-one has time to do it can we at least get detailed instructions on how to do it ourselves? Otherwise Kickstart under D7 suddenly becomes and unusable product.

Thank you

mlecha’s picture

mlecha commented

I did create a git SSH key and tried to commit the changes to distro.make and drupal-org.make for the 7.x-1.x project but don't have rights to commit the change.

$ git push
remote:
remote: ========================================================================
remote:
remote: You are not allowed to push code to this project.
remote:
remote: ========================================================================
remote:
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

I'll try to reach @mglaman and see if we can be taught what to do..

rszrama’s picture

rszrama commented
Title: SA-CORE-2023-004 and -005 » Update Kickstart 1.x for Drupal core and contributed modules
Version: 7.x-1.71 » 7.x-1.x-dev
Category: Support request » Task
Status: Active » Fixed

Sorry for being tardy, y'all ... crazy spring, and we just didn't have the time allocated we needed for updates to legacy projects. Just packaged 7.x-1.72 with updates to Drupal core, Ctools, and Views.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.